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CLAIMS 

1. a countermeasure method for implementation in 
an electronic component implementing a public-key 

5 cryptography algorithm comprising exponentiation 
computation, with a left -to-right type exponentiation 
algorithm, of the type y=g^d, where g and y are 
elements of the determined group G written in 
multiplicative notation, and d is a predetermined 
10 number, said countermeasure method being characterized 
in that it includes a random draw step, at the start of 
or during execution of said exponentiation algorithm in 
deterministic or in probabilistic manner, so as to mask 
the accumulator A. 

15 

2. A countermeasure method according to claim 1, 
characterized in that the group G is written in 
addi t i ve not at ion . 

2 0 3. A countermeasure method according to claim 1, 

characterized in that the group G is the multiplicative 
group of a finite field written GF(q^n), where n is an 
integer . 

25 4. A countermeasure method according to claim 3, 

characterized in that the integer is n equal to 1: n=l . 

5. A countermeasure method according to claim 4, 
characterized in that it comprises the following steps: 
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1) Determine an integer k defining the security 
of the masking and give d by the binary 
representation (d(t), d(t-l), d(0)) 

2) Initialize the accumulator A with the 
5 integer 1 

3) For i from t down to 0, do the following: 

3a) Draw a random integer X lying in the 

range 0 to k-1 and replace the 
accumulator A with A+A,.q (modulo k.q) 
10 3b) Replace A with A*2 (modulo k.q) 

3c) If d(i)=l, replace A with A.g (modulo 

k.q) 

4) Return A (modulo q) . 

15 6. A countermeasure method according to claim 4, 

characterized in that it comprises the following steps: 
1) Determine an integer k defining the security 
of the masking, and give d by the binary 
representation (d(t), d(t-l), d(0)) 
2 0 2) Draw a random integer X lying in the range 0 

to k-1 and initialize the accumulator A with, 
the integer 1+A,.q (modulo k.q) 

3) For i from t-1 down to 0, do the following: 
3a) Replace A with A^2 (modulo k.q) 

25 3b) If d(i)=l / replace A with A.g 

(modulo k.q) 

4) Return A (modulo q) . 
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7. A countermeasure method according to claim 2, 
characterized in that the exponentiation algorithm 
applies to the group G of the points of an elliptic 
curve defined on the finite field GF(q^n). 

5 

8. A countermeasure method according to claim 7, 
characterized in that it comprises the following steps: 

1) Initialize the accumulator A=(A x ,A y ,A z ) with 
the (x,y,l) triplet and give d by the binary 

10 signed-digit representation (d(t + l), d(t), 

d(0) ) with d(t+l) =1 

2) For i from t down to 0, do the following: 

2a) Draw a random non-zero element X from 

GF(q^n) and replace the accumulator 
15 A=(A x ,A y ,A z ) with (A.^2 . A x/ X*3 . A y/ X . A z ) 

2b) Replace A=(A X/ A y/ A z ) with 2*A= (A x/ A y , A z ) 

in Jacobian representation, on the 
elliptic curve 
2c) If d(i) is non-zero, replace A=(A x ,A y/ A z ) 

20 with (A X/ A y , A z ) +d ( i ) * (x, y , 1 ) in Jacobian 

representation on the elliptic curve 

3) If A z =0, return the point at infinity; 
otherwise return (A X /(A Z )^2, A y /(A Z )^3). 



25 9. A countermeasure method according to claim 7, 

characterized in that it comprises the following steps: 
1) Draw a non-zero random element X from GF(q^n) 
and initialize the accumulator A=(A x/ A y ,A z ) 
with the (X AK 2 . x, X^3 . y , X) triplet and give d by 
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the binary signed-digit representation 
(d(t + l), d(t), d(0)) with d(t + l)=l 
2) For i from t down to 0, do the following: 
2a) Replace A=(A x ,A y/ A z ) with 2 *A= (A x/ A y , A 2 ) 

5 in Jacobian representation, on the 

elliptic curve 
2b) If d(i) is non-zero, replace A=(A X/ A y/ A 2 ) 

with (A x ,A y , A z ) +d(i) * (x,y, 1) in Jacobian 
representation on the elliptic curve 
10 3) If A z =0, return the point at infinity; 

otherwise return (A x / (A z )^2, A y /(A Z )^3) . 



10. A countermeasure method according to claim 7, 
characterized in that it comprises the following steps: 
15 1) Initialize the accumulator A=(A x ,A y ,A z ) with 

the (x,y,l) triplet and give d by the binary 
signed-digit representation (d(t+l), d(t), 
d(0) ) with d(t+l) =1 
2) For i from t down to 0, do the following: 
2 0 2a) Draw a random non-zero element X from 

GF(q^n) and replace the accumulator 
A=(A x ,A y/ A z ) with {X . A x/ X . A y , X . A z ) 
2b) Replace A=(A x ,A y ,A z ) with 2*A= (A x , A y/ A z ) 

in homogeneous representation, on the 
25 elliptic curve 

2c) If d(i) is non-zero, replace A=(A x ,A y ,A z ) 

with (A x , A y , A z ) +d (i) * (x,y, 1) in 

homogeneous representation on the 
elliptic curve 
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3) If A z =0, return the point at infinity; 
otherwise return (A x /A 2 , A y /A z ) . 

11. A countermeasure method according to claim 7, 
5 characterized in that it comprises the following steps: 

1) Draw a non-zero random element X from GF (q^n) 
and initialize the accumulator A=(A x ,A y ,A z ) 
with the (X . x, X . y, X) triplet and give d by the 
binary signed-digit representation (d(t+l), 

10 d(t), d(0)) with d(t + l)=l 

2) For i from t down to 0, do the following: 

2a) Replace A=(A x ,A y/ A z ) with 2*A= (A x , A y/ A z ) 

in homogeneous representation, on the 
elliptic curve 

15 2b) If d(i) is non-zero, replace A=(A X/ A y/ A z ) 

with (A x ,A y , A z ) + d(i) * (x,y, 1) in 

homogeneous representation on the 
elliptic curve 

3) If A z =0, return the point at infinity; 
2 0 otherwise return (A x /A z/ A y /A z ) . 



12 . An electronic component using the 
countermeasure method according to any preceding claim. 



